What’s Vulnerable › Vulnerabilities

CVE-2022-38222

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-09-29 · updated 2026-06-17
• Weakness: CWE-416

Description

There is a use-after-free issue in JBIG2Stream::close() located in JBIG2Stream.cc in Xpdf 4.04. It can be triggered by sending a crafted PDF file to (for example) the pdfimages binary. It allows an attacker to cause Denial of Service or possibly have unspecified other impact.

Affected products

• Xpdf: 4.04

References

• https://forum.xpdfreader.com/viewtopic.php?f=3&t=42320
• https://forum.xpdfreader.com/viewtopic.php?f=3&t=42320

Get alerted when CVE-2022-38222 or the next vulnerability affects your stack